PIM Security
Load multicast.anycast.rp.configured.cfg
R9 and XR14 are configured as Anycast RPs. Configure the following protections:
The RPs should not have more than 100 MRIB entries
The RPs should only allow Registers for multicast traffic sourced from R1.
The RPs should rate limit registers to 8kbps on IOS-XE and a maximum of 250 Register states on IOS-XR
The LHRs R5 and XR3 should only allow IGMP Joins to group 239.1.1.0/24. These routers should also limit the total number of IGMP group entries to 100.
Answer
Explanation
The multicast group range is quite large (224/4). This presents an attack vector on the router. A bad actor can exhaust the resources on a router by creating thounsands of multicast state entries. To prevent this, we can limit the number of MRIB entries and IGMP entries.
Note that we can also set the maximum IGMP groups on a per-interface basis as well:
Additionally, we can limit which (S, G) pairs we accept Registers from on the RPs. This feature refrences an extended ACL, in which the first parameter is the source sender (not the router originating the Register, but the source itself) and the second parameter is the destination multicast group.
We can verify this is working by sourcing traffic from another router. For example, if R4 tries to send traffic, we will see that R9 is not willing to act as an RP for this (S, G) pair.
We can also see this on XR4 if we source traffic from a router such as R3. We use debug pim protocol register:
Additionally we can rate limit the Register traffic on the RP. On IOS-XE this is simply a pps rate limiter. On IOS-XR this is the number of Register states. I believe this is how many (S, G) pairs can currently be in the Register state. I am not clear whether this command actually belongs on the FHR.
Finally, we can limit the IGMP Joins based on the group address at the LHRs. This references a standard ACL that simply matches the group address. Anything denied by the ACL is not permitted as IGMP state on the LHR. Note that for IOS-XR, the ACL appears to be backwards. The source portion is really the group address.
We can verify that the filter works by trying to join denied groups on the hosts.
A note on IPv6
IOS-XE does not appear to support limiting the number of IPv6 MRIB entires or rate limiting registers.
However, it does support ipv6 accept-register list <ACL>. It uses the same ACL format as IPv4, where the first parameter is the sending source address, and the second parameter is the group address.
IOS-XE also supports limit the number of MLD state entries and filtering MLD Joins. The filter for MLD Joins uses the source as the first parameter and group address as the second parameter.
IOS-XR appears to support everything for IPv6. Note that the IPv6 ACL syntax is flipped compared to IOS-XE. The group must go in the first parameter. (This is just like IPv4 IGMP).
Last updated
